LiteLLM CVE-2026-42208: Critical SQL Injection in AI Proxy Exploited Within 26 Hours of Disclosure

Summary

A critical SQL injection vulnerability (CVE-2026-42208, CVSS 9.3) in BerriAI's LiteLLM proxy was disclosed on April 19, 2026, and came under active exploitation approximately 26 hours after the GitHub Advisory was indexed globally. The flaw exists in the proxy's authentication mechanism: a database query used during API key validation mixed the caller-supplied key value directly into the query text rather than passing it as a parameterized value, enabling an unauthenticated attacker to craft a m